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We show that the analysis of entanglement distillation protocols for qudits of arbitrary dimension 
D benefits from applying bàsic concepts from number theory, since the set ZJ, associated to Bell 
diagonal states is a module rather than a vector space. We find that a partition of Z£> into divisor 
classes characterizes the invariant properties of mixed Bell diagonal states under local permutations. 
We construct a very general class of recursion protocols by means of unitary operations implementing 
these local permutations. We study these distillation protocols depending on whether we use twirling 
operations in the intermediate steps or not, and we study them both analitically and numerically with 
Monte Cario methods. In the absence of twirling operations, we construct extensions of the quantum 
privacy algorithms vàlid for secure Communications with qudits of any dimension D. When D is a 
prime number, we show that distillation protocols are optimal both qualitatively and quantitatively. 

PACS numbers: 03.67.-a, 03.67.Lx 



I. INTRODUCTION 

Quantum Information Theory (QIT) revolves around 
the concept of entanglement , > • It is the prod- 
uct of combining the superposition principle of Quantum 
Mechanics with multipartite systems - described by ten- 
sor product of Hilbert spaces. Entanglement is central 
to transmiting information in a quantum communication 
protocol or processing information in a quantum compu- 
tation. There are two bàsic open problems in the study 
of entanglement: separability and distillability. Separa- 
bility is concerned with two qüestions, namely, whether 
a quantum state is factorizable and if not, how much 
entanglement it contains. These qüestions are of great 
importance even in practice since entanglement amounts 
to interaction between two or more parties, and thus it 
demands more resources to establish an entangled state 
than a factorized onc. 

Likewise, distillability 0, 0, 0, 0, 0, 03, EU is 
concerned with two qüestions: whether a quantum state 
is distillablc, and if it is, how to devise an explicit protocol 
to extract entanglement out of the initial low entangled 
state. The main focus of our paper is on the construction 
of distillation protocols, rather than a direct analysis of 
the distillability issue. 

The study of distillation protocols for qudits is justi- 
fied since it is known that for mixed states of dimension 
higher than 2 x 2, 2 x 3, it is neither known a complete 
criticrion for separability nor for distillability [9(. 

Separability and distillability are interconnected. En- 
tanglement of a mixed state is a necessary condition for 
being distillable. However, it was quite a surprise to find 
that there exist states that though entangled, they can- 
not be distilled. They are the bound entangled states 
that are characterized by being PPT (Positive Partial 
Transposition) entangled states 01, E3> EU- This sit- 
uation soon raised the question of whether Non-PPT 
states were all distillable. Although there is not a con- 
clusive answer, yet there is strong evidence that this is 
neither the case since Werner states which are finite-n 
undistillable have been found HB- 



In this paper we study entanglement distillation pro- 
tocols for qudits using the recursion method 0,0. The 
mixed states to be distilled are diagonal Bell states of qu- 
dits, but they do not need to be tensor product of pairs 
of Bell states. Moreover, we can also distill non-diagonal 
states. 

We make significative progress in the understanding of 
these protocols and find new efficient variants of them by 
using number theory. This number theory enters in the 
properties of the module Z that appears in the labelling 
of the Bell diagonal sates of qudits. Local permutations 
acting on these states by means of unitary operations 
serve to construct generalized distillation protocols [ïo) . 
As a byproduct, we also introduce heterotropic states 
(|38|l as the invariant states under the group of local per- 
mutations. 

As a result of this study, we find that qudit states 
with dimension D a prime number are qualitatively and 
quantitatively the best choices for quantum distillation 
protocols based on the recursion method. Qualitatively, 
since we show that for D not a prime number there ap- 
pear disturbing attractor points in the space of fidelity 
parameters that deviate the distillation process from the 
desired fixed point that represents the maximally entan- 
gled state. This phenomenon is absent when D is a prime 
number and ZJ, becomes a vector space. Quantitatively, 
since we propose distillation protocols that when D is a 
prime number, they distill all states with fidelity bigger 
than without resorting to twirling operations. 

We hereby summarize briefly some of our main results: 
i/ We proof that the group of local permutations for qu- 
dits of arbitrary dimension D is the semidirect product of 
the group of translations and simplectic transformations. 
This structure plays an important role in the distillation 
protocols for qudits. 

ii/ We simplify the problem of finding the best distillation 
protocol to that of finding the best set of coefficients of 
a certain polinomial constraincd to the existence of a 
suitable vector space. 

iii/ We introduce the concept oïjoint performance param- 
eter r\ (|rJ5|l that allows us the comparison of distillation 
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protocols with different vàlues of fidelity, probability of 
success and numbcr of Bell pairs used altogether. It is a 
figure of mèrit for low fidelity states above the distillation 
threshold where the recursion method is specially suited 
for distillation, prior to switching a hashing or breeding 
method. 

iv/ We analyze several distillation protocols assisted with 
twirling operations as the dimension D of qudits vary 
We find that the best performance according to r] is not 
achieved for qubits (D = 2), but for qutrits (D = 3) and 
n = 3 input pairs of Bell states as shown in Fig. and 
Fig. [21 We also find that it is not possible to improve r\ 
by indefinitely increasing the number of input pairs n. 
v/ We propose a distillation protocol without resorting 
to twirling operations for n = 4 input Bell states and 
m = 2 output Bell states that is iterative and its yield is 
greatly improved: about four orders of magnitude with 
respect to the protocols based on twirling, even for states 
quite near the fixed point. This is shown in Fig.JSJ 
vi/ We propose and study an extension of the Quantum 
Privacy Amplification protocols Q that work for arbi- 
trary dimension D. 

vii/ We find indications of the existence of non-distillable 
NPPT states by studying the distillation capacities of 
protocols for several vàlues of D, as shown in Fig. 

This paper is organized as follows: In order to facilitate 
the reading and exposition of our results, we present the 
proofs of our theorems and technicalities of the numerical 
methods in independent appendices. Sect.^deals with 
the bàsic properties of diagonal Bell states for qudits and 
introduce a partition of the module Z£>. Sect. Illll treats 
the group of local permutations acting on qudits in di- 
agonal Bell states. Sect IIVI describes the group of local 
permutations and the twirling operations associated with 
it. We characterize states that are invariant undcr these 
operations as heterotropic states. In Sect.[V]we present 
all our distillation protocols based on local permutations 
of qudits in diagonal Bell states, both with and without 
resorting to twirling operations. To this end, we make 
extensive use of the theoretical results found in previous 
scctions and devise numerical methods to analyse effi- 
ciently the properties of the proposed distillation proto- 
cols as different parameters such as D, F, n, m etc. vary. 
Sect. lVll is devoted to conclusions and future prospects. 

II. BASIC PROPERTIES OF DIAGONAL BELL 
STATES FOR QUDITS 

A. Bell States Basic Notation 

The quantum systems we are going to consider are qu- 
dits, which are described by a Hilbert space of dimension 
D > 2, and finite. The elements of a given orthogonal 
basis can be denoted \x) with x — 0, . . . , D — 1. This 
set of numbers is naturally identified with the elements 
of the set modulus 

Z D := Z/DZ, (1) 



and we shall informally use them as if they belonged to 
Z]j. In general, whenever an element of Zjj appears in 
an expression, any integer in that expression must be 
understood to be mapped to Zj> 

We consider two separated parties, Alice and Bob, each 
of them owning one of these systems. The entire Hilbert 
space then is Tí = Ha A mixed state of the whole 

system is called separable when it can be expressed as a 
convex sum of product states |17| : 

p = Y l Pi\e i )(e i \®\f i )(f i \, le^HA, (2) 

i 

A state which is not separable is said to be entangled. 

Elements of the computational basis of a pair of qudits 
shared by Alice and Bob are denoted as 

i,jeZ D . (3) 

To shorthen the notation, it is convenient to introduce 
the symbols 

<S:=^E> S{k):=VDÓ kl0 , V {k):=^\ 
k VD kez D 

(4) 

chosen so that Skf(ik) — 5(i) and S k S(i — fc).f(fc) = 
f(i ) (i € Zp). Bell states are defined as [Ï3, [ïj|, |2Cj . 

|Ú')b ·=S ( P( ki )\ kk -3) i,jeZ D . (5) 

k 

Bell states are an example of maximally entangled states. 
In fact, any maximally entangled state can be identified 
with the |0 0) B state by suitably choosing the computa- 
tional basis of each of the qudits, due to the Schmidt 
decomposition. 

The fidelity of a mixed state p is defined as 

F := max(*|/9|*), (6) 

where the maximum is taken over the set of maximally 
entangled states. The aim of distillation protocols is to 
get maximally entangled pairs (fidelity one) by means of 
local operations and classical communication (LOCC), 
starting with entangled states of fidelity lower than one. 
Because of the previous comment, we will always sup- 
pose, without lose of generality, that the initial fidelity 
of the states to be distilled is equal to B (0 0|p|0 0) B , and 
the aim of our protocols will be to obtain distilled states 
as close as possible to this Bell state. 

Of special interest are the mixtures of perfectly entan- 
gled states and white noise, known as isotropic states: 

Pisa := F |0 0) B (0 0| + -^-^ (1 - |0 0) B <0 0|) , (7) 

where F is the fidelity of the state. These states are 
known to be entangled and distillable iff F > jy • 
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The main interest of these states comes not only from 
their physical meaning, but also from the possibility of 
transforming any state in an isotropic one through a 
twirling operation. In general, the twirling consists in 
a random application of the elements of a certain group 
of unitary operations, say IA, to each of the systems in an 
ensemble. Namely, its action is 

T u (p) := f dUUpUl (8) 
Ju 

The result of such an operator must be a sum over the 
states invariant under the action of the group. In the 
case of isotropic states, a suitable election is the set of 
transformations of the form U <$ U* . 

When managing múltiple shared pairs, vector notation 
is necessary; k e ZJ, stands for k = (k%, . . . , k n ), h g 
Zjj. Scalar product will be employed with its usual 
meaning. The generalization of the previous expressions 
is straightforward: 

S=S S, 6(L·):=S(k 1 )---S(k n ). (9) 

Again, <Sk (p(i • k) = 5 (i) for any i £ Z£>. The computa- 
tional basis and the Bell basis are: 

71 

|ij) :=®l»*Jfc>, 
fc=i 

n 

|i j) B := <S> l<* 3h)n = S<P{i ■ k)|kk- j), (10) 
fe=l k 

with i,j e Z^j. In order to simplify the notation, some- 
times we will work with vectors over ZfJ 1 and write states 
as |x) in the place of |ijj), with 

x := (ix, . . .,i n ,ji, ■ ■ ■ Jn). (11) 

B. A Partition of Z£ with Divisor Classes 

In general, Z^ is not a field and thus is not a vector 
space, but a module. We can still make use of some prop- 
erties associated to vector spaces and so we will abuse a 
bit of the term vector. For a detailed exposition see ap- 
pendix^ but it is enough to know the following. The 
usual dehnition of linear independence makes sense, as 
one can demonstrate that any linearly independent set 
of vectors can be extended to a complete base and also 
that a square matrix composed by such a set is invertiblc. 
A subspace is defined to be the set of linear combinations 
of a linearly independent set, and its dimension is the car- 
dinality of these set of generators. Orthogonality poses 
no problem, since the set orthogonal to a subspace is a 
subspace, and it has the expected dimension. 

Working with this pseudo-vector space Z^> requires 
care. Some vectors can be taken to the null vector by 
multiplying them by a non-zero number. For example, 



D 


2 
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2 


2 


4 


2 


MD) 


3 


8 


12 


24 


24 


MD) 


7 


26 


56 


124 


182 



TABLE I: Vàlues of the generalized Euler's totient function 
4> n (D) for several qudit dimensions D. 

for D = 4 we have 2 • (0, 2) = (0, 0). In order to classify 
this anomalous vectors, consider the set of divisors of D: 

div(D) := {d e N : d\D}. (12) 

This set inherits the ordering of N, and we shall use this 
property to introduce a suitable gcd function in Zid '■ 

Definition II. 1 For every S C Zjj we define the greatest 
common divisor of S , or gcd(S'), to be the greatest d € 
div(D) such that |s = 0,Vs€ S. 

The nomenclature was chosen because for any d S div(D) 
and ieZwe have 

d\x D\^x ^> ^ = (mod D), (13) 

and then for any set of integers X 

gcd(A) = max{de div(D) : d\x\f x e X}, (14) 

where X is the corresponding set in Zrj. 

Vectors over Zijj are n-tuples of elements in Z^, and 
so we extend the gcd function to act over Z^ in the 
natural way, that is, if v = [v\,...v n ), gcd(v) := 
gcd({i>i, . . . ,v n }). Now we can consider an equivalence 
relation in ZJ, governed by the equality under the gcd 
function. The corresponding partition consists in the 
sets: 

C d (D,n) :={veZ£ : gcd(v) =d}, d e div(D) (15) 

The most important of these sets is Ci(D,n), since it 
contains those vectors v for with {v} is linearly indepen- 
dent. Later we will need its cardinality when considering 
properties of local unitary operators acting on diagonal 
Bell states. Thus, it is useful to define: 

MD) ■= {í Cl (D,„) Ull < W) 

For the particular case of n = 1, 4>i(x) corresponds to Eu- 
ler's totient (^-function 22]. Euler's 0-function appears 
naturally in number theory since it gives for a natural 
number n, the cardinality of the set {m = 1, . . . ,n — 1 : 
gcd(m,rt) = 1}. That is, 4>\{n) is the total number 
of coprime integers (or totatives) below or equal to n. 
For example, there are eight totatives of 24, namely, 
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3 
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24 


48 


120 


144 




720 


51,840 


737,280 


9.36 • 10 6 


~ 3.7 ■ 10 7 




1,451,520 


~ 9.2 • 10 9 


~ 3.0 • 10 12 


~ 9.1 • 10 13 


~ 1.3 • 10 16 



TABLE II: Vàlues of the number of elements of the group Vs(D, n) for several qudit dimensions D. 



{1,5,7,11,13,17,19,23}, thus X (24) = 8. For n ^ 1, 
we have therefore introduced a generalization of Eulcr's 
totient function for elements in Z^> . The following lemma 
gives us how to compute the cardinalities of the sets 
Cd(D,n), which shall naturally arise in our analysis of 
distillation protocols. 

Lemma II. 2 For every n S N, D S N — {1} and d £ 
div(£>); 



b n (D) = D n fi 



p n - 1 



(17) 



2. 



3. 



ÜC d (D,n) = 



£ Md') = D" 

d'edív(D) 



(18) 



(19) 



The proof of this lemma can be found in appendix[B] As 
an illustration, we list several vàlues of 4> n (D) in Table^ 



III. THE GROUP OF LOCAL PERMUTATIONS 

The main constraint Alice and Bob have to face when 
they intend to distill qudits is that they can perform only 
local operations. If we consider only unitary operations, 
we are led to the group U lac of local unitary operations. 
Its elements are all of the form 



U=U A ®U B . 



(20) 



In this section we shall study the subgroup U B loc , defined 
as the group of local unitary operations which are closed 
over the space of Bell diagonal states, that is, states of 
the form 



£ 



(21) 



where the label (n) is a reminder that we are considering 
states of n pairs of qudits. The aim is to use the acquired 



knowledge to devise distillation protocols specially suited 
for these states. 

More specifically, we analyze the group U Bloc (D,n) of 
local unitary operators over the space spanned by the 
tensor product of n pairs of qudits of dimension D for 
which the image of a Bell diagonal state is another Bell 
diagonal state. The first we notice is that the result of 
applying such an operator over a pure Bell state is an- 
other Bell state (it cannot be the convex sum of several 
Bell states because it must remain pure) . Since the map- 
ping of Bell states must be one to one, the action of any 
U EU B ioc (D, n) involves a permutation of the Bell states: 



UpU*= £ 74"»Kx)) B (vr(x)|, 



(22) 



xez 



where tt : 7?$ — > Z 2 ^ 1 is a permutation. So we introduce 
■pi oc (.D, n), the group of local permutations, as the set of 
permutations over Z^ 1 implcmcntable over Bell states by 
local (unitary) means. 

Before stating the main result of this section, we shall 
define several groups. Consider the family of unitary op- 
erators u x (x £ Z^J 2 ) over Bob's part of the system such 
that by definition 



1 <g> < |0> 



(23) 



where conjugation is taken respect to the computational 
basis. With this operators at hand, we construct the 
group U Binv (D, n) with the elements C/ x := u x (giw x *. We 
claim that it is a subgroup of U Blac (D, n). An explicit 
calculation shows that the action of its elements is 



(7 x |y) B = ^(x í r!y)|y) E 
where tt e M 2rlX 2n(Z,D) is 



Cl := 



1 

-1 



(24) 



(25) 



So the special feature of U Biav is that for p [n) Bell di- 
agonal U x p {rl) U^ — p (n \ which means that its elements 
implcmcnt the identity permutation. 

We also define two subgroups of the group of permuta- 
tions over ZlJ 1 . The translation group V T (D,n) contains 
the permutations of the form 



7Ta(x) 



(26) 
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with a £ Z^ 1 , and the symplectic group V S (D, n) contains 
in turn those whose action is 

tt m (x) = Mx, (27) 

where M £ M2„ X 2n(Z,D) is such that 

M* Í1M = . (28) 

V s (D,n) is a finite non-simple group. A suitable gen- 
erator set for this group is presented in appedixjü] Now, 
we are in position to establish the following theorem that 
plays an important role in the distillation protocols for 
qudits to be devised later on. 

Theorem III. 1 

1. Vioc is the semidirect product ofV s and V T : 

V l00 (D,n)=V T (D,n)KP B (D,n) (29) 

2. Given U\,U2 £ U Blac {D,n) such that they yield 
the same permutation in V loc , there exists U x £ 
^Binv(-D, n.) such that 

U l U^ 1 = <j)Uy i (30) 

where 4> is a phase. 

We prové this theorem in appendix[D] For qubits (D = 
2), part 1 of this theorem was proved in using a 
mapping between Bell states and Pauli matrices. Our 
proof does not rely on this mapping and being completely 
different, it becomes general enough so as to treat all 
qudits of dimcnsion D on equal footing. 

■p s is specially well suited to construct distillation pro- 
tocols, and so it is worth a closer study of its properties. 
There is another interesting way of writing 128[) : if we call 
Ui the first n rows (columns) of M and the last n rows 
(columns), the condition can be rewritten in a canonical 
simplectic form: 

u* ü Uj ■ = 

v*Ov,=0 (31) 
ujílVj = 5ij 

This point of view is specially useful when systematically 
constructing the elements of V s , thanks to the following 
result: 

Theorem III. 2 

1. Consider a linearly independent set of vectors 
{ui, . . . ,u r ,Vi, . . . ,v s ,v r+ i, . . . ,v r+í } C Zf? with 
(s < r < n, s+t < n). Ifthis set satisfies conditions 
(|3ip. it is always possible to complete it preserving 
them. 

2. The cardinality ofV s is 

n 

$V s (D,n) =D n2 Y[<h k (D) (32) 



We prové this theorem in appendix [EJ As an illus- 
tration, we list several vàlues of %P§{D,ri) in Table ITT1 
Clearly numbers grow fast, which makes unfcasible any 
numerical investigation which requires going over the ele- 
ments of the whole group even for not very large vàlues of 
n. In any case, it can be helpful to have an algorith which 
allows this task without the expense of storing the ele- 
ments. Consider any suitable ordering over Z|^. Given 
an element of V s (D,n), we can increase its last row ac- 
cording to this order till another element is reached. If 
this fails, the same can be done for the previous row, and 
so on and so forth. However, this is not very efhcient, 
and we can do it better combining part one of theorem 
IIII.2l with lemma IU"T1 For example, for any of the last n 
rows we could substitute the search with the application 
of a suitable generator from lemma IC. II Then the addi- 
tional information contained in the proof of theorem lIII.2l 
would guarantee that we were not forgetting any element 
of the group. Moreover, as we shall later see, tipically we 
are only interested in some of the rows of the matrix, and 
then part 1 of the theorem is crucial since it allows usto 
ignore unimportant rows. 

IV. TWIRLING WITH W Bi „v AND V loc 

We now explore the possibility of using the groups of 
the previous section with the twirling operator © , which 
for finite groups is: 

V&A 

Consider now the group U B iav (D,n). From (|24|l , it follows 
S U z |x) B (y | U\ = í(x - y) |x) B (x| , (34) 

z 

which means that the action of Ty B inv over a state leaves 
Bell diagonal elements invariant, whereas the off-diagonal 
components are sent to zero. 

The group V s can also be successfully used in twirling 
operations. This asseveration, however, has no meaning 
by itself since V s is not a group of transformations over 
the n pairs of qudits. We have to choose any mapping 
U : Vs — > U B loc such that 

UW\x) B (x\UÍW = \irW)Mx)\- (35) 

There are many possible realizations for this mapping, 
and at least in general the image of the mapping is not a 
subgroup of U Bloc . However, it is a group when consid- 
ered as a set of transformations over Bell diagonal states. 
Thus, for p Bell diagonal the following makes sense: 

TvM-èr E U(tt) P U(^. (36) 

To perform the sum we need to know which are the states 
invariant under the action of the group. 
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Theorem IV. 1 For every x,y e Z|j l , gcd(x) = gcd(y) 
if and only if there exists a permutation in V S {D, n) with 
associated matrix M such that x = My. 

Proof. The if direction follows from M being invertible, 
since then dMi = Mdi — iff di = 0. We now proof 
the only if direction. Let d = gcd(x) and consider any 
u € Zjj such that du = x (note that gcd(u) = 1). {u} 
is linear ly independent, and so there exists a matrix M 
associated to a permutation in V 3 {D,n) having u as its 
first column (see theorem |lII.2fl . Then, if v = (d, 0, . . . , 0) 
we have x = Miv. The same reasoning is true for y, 
giving y = M 2 v and thus M = MiM 2 _1 . □ 
Now, let us recali the partition in Zj^ associated to 
the function gcd (see 1)15(1 ). We define the related states 



Pd 



1 



Ei-) 

xec d 



(37) 



These are the invariant states we were searching for. 
Thus, if p is Bell diagonal: 



T v s (p)= 2^ ^KJ^TïP* 



dGdiv(D) 



Tr(p d p d )' 



(38) 



Note that we have not taken into account the number of 
pairs involved, since it is unimportant. However, usually 
twirling operations are interesting for n = 1. In this case, 
in analogy with isotropic states, we shall call heterotropic 
states those states invariant under (|38|l . If p is not Bell 
diagonal, we can still obtain the same result with the 
operator 



T U Bloc xV s (p) 



1 1 



(39) 

As a corollary, if D is prime there are just two Bell diag- 
onal invariant states 



Po = |0) B (0|, 



(40) 
(41) 



and thus the result of the twirling operation is an 
isotropic state, which is the simplest example of an het- 
erotropic state. 



V. PERMUTATION ASSISTED DISTILLATION 

In the distillation protocols we consider, which are it- 
erative, each iteration cycle can be decomposed in the 
following steps: 

1. At start, Alice and Bob share n qudit pairs of di- 
mension D and state matrix p {n) . 

2. They apply by local means one of the permutations 
7T AÍ € V s (D,n) in 



3. They measure the last n — m qudit pairs, both of 
them in their computational basis. 

4- If the results of the measurement agree for each of 
the measured pairs, they keep the first m pairs ( in 
the state p {m) ). Else, they discard them. 

In most situations, the initial n pairs are independent 
and have equal state matrices p. In these cases 



'8 n 



(42) 



In general (for m > 1) this does not guarantee that p (m) 
will be a product state, however, and thus it is preferable 
to consider the most general case. 

The process can be pcrformed several times in order to 
improve the entanglement progressively, but it is worth 
taking into account that a scheme of this kind with s 
steps and, say, n = 2 and m = 1, is equivalent to a 
single-step one with n' — 2 S and m! = 1. It is enough to 
perform initially all the permutations and afterwards all 
the measurements. Although convergence properties are 
the same, the equivalence is not complete since from a 
practical point of view the step by step method will give 
a better yield. This is so because an undesired result in 
the measurement is morc harmful in the second case, as 
more pairs must be discarded at once. 

In appendix [0 we derive an expression for the state 
of the remaining pairs of qudits after a successful mea- 
surement. It appears that the protocol is blind to non 
diagonal states (in the Bell basis). So let us define 



£ ]T U(n)UpUÏU(n)ï. 



x|p w |x) 



x e zg". 



If we call V M the space generated by the last n — m 
rows of M (the matrix associated to ir M ) the probability 
of obtaining the desired measure is 



p= E í# 



(43) 



and the recurrence relation for the probabilities is 



p Z—í Aíy+M-ix' 

yeV M 



where x 6 Z^™ and x 6 Z^ 1 is 



(•ï'i 



,0,x 



n+l, 



0,...,0). 

n—m 



(45) 

Note that since M 1 = Çl t M t Çl, rows m + 1 to n (of 
M) do not take part in the expression, and therefore the 
protocol does not depend on them. 

Consider the following family of heterotropic states: 



Pd 



xez 2 n 



X JI X M X I> 



d E div{D). (46) 
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From theorem IIV. l·l we know that 



A. Twirling assisted protocols 



í(rfMx) = 5(dx). 



(47) 



Using this fact and equation (|F4|) . one can readily check 

that for p<"» = p^ n Bü gives p (m) = p^® m . Therefore, 
these heterotropic states are always fixed points of the 
protocol and candidates for attractors. 

In the case of single-step protocols, we are only inter- 
ested in the final joint fidelity (the probability of the state 
being |0) B (0|) 



E 

xeVji,/ 



„<") 



(48) 



where the label (m) reminds us that this is the joint 
probability of the m pairs being in the desired state. In 
general, the fidelity of each pair will be greater. If m = 1 
these distinction vanishes, and we will simply write F' 
instead of F ll) . Equations and I02J> show how the ef- 
fect of the entire process relies only in the set V M , thereby 
rcducing the search for cfficient protocols according to 
part one of theorem IIII.2I 

We now consider the Fourier transform of the proba- 
bilities 



to obtain 



xe z 2 " 



D 



xez 



p = D m-n J2 pW, 



where we have used 



vGV 



if u £ V A 

(tv if u e v A 



(49) 



(50) 



(51) 



with V being a subspace of ZJ> and u e Z . Gathcring 
these results, we have 



F [ 



D 



y 

n—m ^— ' 



(52) 



an expression for the final (joint) fidelity which can 
lighten its direct computation when l|42(l holds, since for 
this case we can define for a, b S Z^: 



Pab ■= s (a b\p\a b) B , p ài := ^ ip.(aa + bb)p ab 



a.beZz 



and thcn 



Px' = II/' 



P'í = JlPxuXn+i 



(53) 



(54) 



In order to understand better equation (|4^jl . we will 
adopt a useful simplification which generates by itself a 
whole family of distillation protocols. We consider only 
initial states for which the pairs are mutually indepen- 
dent and equal as in (|42l) . Moreover, before each itera- 
tion we introduce any twirling operation which leads to 
an isotropic state while preserving the fidelity, as in (7J. 
This way the evolution of the state through the distilla- 
tion protocol is described entirely by a single parameter, 
the fidelity F. 

We would like to evaluate l|54|l . We need: 



Pab = FSab 



D 2 F - 1 



Pab = 5 àb + D 2 _ l i 1 - S àb) 



(55) 
(56) 



Defining Ci(F) 



l-F 



F(D' 2 



^ and c 2 (F) := ^i^, this 



implies that for any x we have p^ — F n c\{F) s and 
p 1 ^' = C2(F) S , where n — s is the number of occurrences of 
Poo in the product (that is, (J{r = 1, . . . , n : x r = x n+r = 
0}). Since p ( ^=pW, 



we can write 



F' 



D r ' 



x(ci(F)) 
X(C2(F)) 



and 



P = D r ' 



1 X(C2(F)). 



(57) 



(58) 



where x( x ) = J2™=o ^ sXS ^ s a polynomial with coefficients 
defined by 



X s := )t{x S V M 



(t{r = 1, ...,n : x r 



'n+r = 0} }. 

m 

This dcfinition is not very useful when trying to construct 
a suitable V M for a given x, but we can do better. Let V r 
be the set of linear combinations of columns r and n + r 
of the matrix formed by the last n — m rows of M, (or 
any other matrix of size (n — m) x In such that its rows 
span V M ). If V r is a subspace of Z^, - ™ for every r, which 
indeed is always the case for D prime, we can rewrite 
as 



A s = |{veZ 



n—va 
D 



- s = Jj{r = 1, 



n-.veV^}} 

We remark that x depends only on V M , which is a sub- 
space of Zij^ of dimension n — m constrained only by 



u t Qv = Vu,vGK,. 



(61) 



It is apparent that x(l) = D n ~ m and x(0) = 1. For 
m = 1 (|57|l becomes the recurrence relation F' = F'(F), 
and then among the fixed points are F = 1 (perfect en- 
tanglement), F = (maximum fidelity for separable 
states) and F — (pure noise). 
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• n = 2 

* n = 4 

. n.3 



0.005 - 



10 12 14 16 18 20 

D 



FIG. 1: Vàlues of the coefficient r\ for the considered protocols 



Thcrcforc, wc havc rcduccd the problcm of finding the 
best protocol to that of finding the best coefficients for 
the polynomial, constrained to the existence of a suit- 
able vector space. In the next subsection, we survey this 
issue for several vàlues of n, but previously a small con- 
sideration is worthwhile. For the identity permutation 
(which of course is completely useless) the coefHcients of 
the polynomial are A s = [ n ~ m \(D — l) s and therefore 



P 



1 + {D-1)F 
D 



(62) 



One expeets the probability of a useful protocol to be 
less than this, but then the decay is at least exponential 
respect to an increase in n — m. This is an early advisory 
that considering progressively larger vàlues of n needs 
not be better. 



1. Low fidelity states 

Now we will concentrate on low fidelity states near F = 
j). Since hashing and breeding protocols are available 
for high fidelities [(|, one reason for studying this 
range is that it is the natural testground for the class of 
protocols we are analyzing. It is interesting also because 
we can develop a method to compare in a simple manner 
protocols with different n. 

We start by discarding protocols with m > 1. The 
reason to do so is that F(jj) = Since one does 

not expect the resulting pairs to be statistically uncorre- 
lated, in general the individual fidelities will be less than 
jj, making the algorithm useless near the point of inter- 
est. We will see later how protocols with m > 1 can be 
fruitfully used. 



A problem arising when comparing different protocols 
is that several factors take part at the same time, mak- 
ing it difficult to balance them in a simple manner. In 
our case, we have to take into account the probability 
of obtaining the right measure P, the number of pairs 
used n and the output fidelity F'. We will now see, how- 
ever, that restricting our attention to low fidelity states 
allows us to introduce a single coefficient which makes 
possible the comparison. We shall call this coefficient 
the joint performance rj of a distillation protocol and it 
is constructed as follows. 

Let us consider an isotropic state of fidelity -jj + e. 
After q steps of the protocol, at the lowest order in e, the 
state will have a fidelity + Ffe and the yield will be 



Fi 



with 
dF' 

~d~F 



2D 

D 2 - I 



dx 



log{x(x)) 



- D+l 

(63) 
(64) 



We will assume F\ > 1, since the protocol must be mean- 
ingful. The yield after amplifying e by a factor t is rj los ^ , 
and thus it is justified the introduction of the coefficient 



rj := exp 



log(Po) - log(n) 
log(F x ) 



(65) 



As F\ < n and Po < 1, then r\ < e~ l . 

We are ready to compare several protocols, which we 
shall do progressively increasing the number of discarded 
pairs. 

• n = 2. When H6U|) applies, there are just two possi- 
bilitics. One corresponds to the identity permuta- 
tion an the other is 



X(x) = 1 + (D- l)x 2 . 



(66) 



This corresponds to the original distillation proto- 
col discussed in 6]; no surprises. If D is not prime 
there are other possibilities, but rj is not greater for 
them. 

• n = 3. We must distinguish two cases. If D is odd, 
the best value of rj is attained with 



X (x) = l + (D 2 -l)x 3 . 
If D is even, however, the best option is 
X (x) = 1 + (D- l)x 2 + (D 2 - D)x 3 . 



(67) 



(68) 



The difference is due to the impossibility of con- 
structing a suitable V M in the second case, as we 
now show. Let {u, v} be a base of V M . Then, con- 
dition i|ïïT|) is equivalent to 



3 

E 

i=l 



"3 + 7 

"3+i 



(69) 
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2. Protocols with m > 1 



n = 3 



'n = 2 



0.5 0.6 



0.7 0.8 0.9 



FIG. 2: Evolution of the fidelity for the distillation protocols 
assisted by twirling when n = 2, 3 for qudits with D — 3. 



In order to obtain l|67|) the determinants appear- 
ing in the sum should have an invertible value (see 
(jnni)j but then they cannot sum up if D is even. 

• n = 4. In this case we have found that the best 
polynomial is: 



X(x) = 1 + 4(D - 1> 3 + (D 3 - 4D + 3)x 4 



(70) 



As an example of realizing this case, set V M — 
Lin{u, v, w} with 



u= (1,0, 0,1, 0,1, 0,0) 
v = (0,1, 0,0, 1,0, 1,0) 
w= (1,1,-1,0,0,0,0,1) 



(71) 
(72) 
(73) 



Figurendisplays the vàlues of rj for these protocols and 
several dimensions. Note the bad performance of the case 
n = 2 for qubits, which is in fact the most important of 
all. On the other hand, qutrits (D = 3) obtain the best 
yield among the proposed protocols, thanks to the ad- 
vantage of odd dimensionality (for n = 3). In connection 
with this, see also figure El 

One could ask wether it is possible further improve- 
ment on rj by means of increasing n. Figure ^ suggests 
that this is not the case, at least for D > 2 . Explo- 
ration shows that nothing is gained in the case of qubits 
neither. This result is an indication of the futility of in- 
creasing n with the aim of improving performance. In 
[To| it is claimed that protocols with higher n should im- 
prove the yield, but apparcntly they do not take into 
account the (strong) reduction in the probability as n in- 
creases. This idea clarifies figure Q] since from (16211 we 
expect P < 2 n ~ 1 (D + l) 1- " and then the reduction of 
the probability with n is more dramàtic as D increases, 
whereas the performance gain from í\ is at most linear 
(Fi<n). 



When considcring states of higher fidelity, an impor- 
tant advantage of the proposed protocol for n = 3 and D 
odd is that the derivative of F'(F) vanishes for F = 1, 
a qualitative difference with the n — 2 case (see figure 
121 . This is important for states close to the Bell state, 
since a fidelity 1 — e is mapped to 1 — 0(e 2 ). We now 
show how the ratio — = 2 can be preserved whilc this 
desirable characteristic is added. 

Using the definitions in lemma lÜTl consider the per- 
mutat ion 



_fcí 



"++ •= ( 7r + 07T + 
The action of 7ri 2 , is 



7r +) 



KU) = (Íl +«2, .72 +k,33, 



■ j jn ) I 



(74) 



(75) 
(76) 



We propose for n = 4 and m = 2 a protocol in which the 
permutation n M of step 2 is 



TT^oTr^oTriioTrS. 



This permutation yields 

X{x) = 1 + (D 2 - í)x 4 . 



(77) 
(78) 



The resulting two pairs of qudits will be correlated, 
thereby providing us with a good scenario for hashing, 
and one could consider an iterative protocol in which the 
bàsic unit were pairs of pairs of qudits (instead of pairs). 
We shall keep things simple by choosing D = 2 and con- 
sidering the partial traces of each of the pairs (which are 
equal due to symmetry of the permutation) in order to 
obtain the individual fidelity: 



F A 

F'= — 
P 



1 + 4c 2 (F) 2 + Ac 2 (F) 3 + 7 c 2 (F) 4 



(79) 



The results for D = 2 arc displayed in figures and ^ 
The yield T of figure^Jis calculated step by step through 
the following recursion relation: 



m 



fc-ij 



ïn = I- 



(80) 



Regarding the n = 2 case, the yield is greatly increased 
(four orders of magnitude) even for states quite near to 
the fixed point. The drawback is the impossibility of 
distillation for F < 0.64, but let us recali that this is be- 
low the lowest fidelity distillable with a hashing method, 
F « 0.81 |6j. The conclusion then is that one should 
consider this kind of protocols in the latest steps prior to 
hashing. 



B. Protocols without twirling 

The use of twirling involves loosing entanglement, and 
thus the protocols we have considered so far are a good 
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0.9 - 



0.7 - 



0.6- m = 1. 



0.5 v 



0.7 0.8 
F 



FIG. 3: Evolution of fidelity through the proposed n = 2ra 
protocols for D — 2. 




FIG. 4: Yield T after reaching a fidelity at least 0.99 
through the proposed n = 2m protocols for D = 2. 



starting point towards more sophisticated ones in which 
a careful selection of the permutations avoids the use of 
twirling techniques and allows for the distillation of states 
with fidelity less than if D > 2. 



1. Quantum Privacy Amplification 

This idea was first explored (for qubits) in [j| , where a 
quantum privacy amplification scenario was considered. 
In this situation the state to be distilled is the average 
over an ensemble, not necessarily known, and so the per- 



mutations must work well in general. We shall now gen- 
eralize this algorithm to qudits, guided by the main role 
the vector space V M plays, as introduced in the begining 
of Sect. [V] The proposed generalization is an iteration 
with n = 2 and m = 1 as in the original case. It consists 
in an alternated application of two permutations: 

i 2W ( 81 ) 

The (relative) simplicity of these operations is a first 
interesting point of the algorithm. The choice follows 
from the intention to preserve the form of V M with respect 
to the known case D = 2, as the number of iterations 
grows. For s iterations, M in this case is the 2 S+1 x 2 S+1 
matrix which would follow by considering the process as a 
single iteration, with a unique permutation and a uniquc 
measurement. 

Although the two permutations alternate, it is possi- 
ble to give a single recursion relation for every iteration 
cycle. To this end, let us introduce the elements of an 
alternative Bell basis as 



|ij> 



(82) 



Then, in order to achieve this, it is enough to change 
the Bell basis to (|82f) after the first cycle, switch to the 
original Bell basis after the second, change again to lJ52"|) 
after the third one, and so on. With this little trick, we 
get the following recursion relation: 

1 



Pi 



kez D 
1 

D 



-i—j — k Pk.j~ki 



p = 



E 



Pkk 



(83) 



(84) 



fceZi 



It is interesting to note that the permutation that can 
switch between the two basis is not achievable by local 
means. If this were so, we could avoid the use of two 
different permutations and still get the same recursion 
relation, but unfortunately it is not the case. 

Figure shows the yield of this protocol compared to 
the equivalent protocol of the previous subsection IV Al 
The improvement is clear. As D increases the results are 
less spectacular, however. An important detail is that 
now the distillable states are not simply those for which 
fidelity is greater than j^. As one can check in Fig. [ü] 
some states over this point are not distilled whereas other 
states beneath are. Qubits are the only ones behaving as 
expected: the total volume of Bell states with F > | is 
distilled, whilc those bclow it are undistilled. In any case, 
the normalized volume of states showing bad behavior, 
i.e. those with F > -jy which are not distilled, is small 
if D is prime. This is not so for non prime D's because, 
as discussed in section new fixed states emerge for 
composite numbers creating undesirable attractors. We 
find that these attractors are specially harmful for states 
near to heterotropic states. As a corollary, we show that 
the permutational approach to distillation is more suited 
to prime D's. 
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F 

FIG. 5: Yield T JSÜJ after reaching a fidelity of at least 0.99 
through the protocol proposed in the text: for isotropic states 
(sòlid line) and as a mean over Bell diagonal states (dashed 
line) compared to the same yield using the twirling protocol 
for n — 2 (dotted line). The case under study are qutrits 
(D = 3) and the mean refers to the measure discussed in 
appendix IU1 with Monte Cario. 




0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 



F 

FIG. 6: Normalized volume V of distilled Bell diagonal states 
for the protocol under study, given by permutations I81H with 
D = 2,3, 4, 5, 6. The measure is described in appendix Icl and 
uses Monte Cario. 



2. Distillabüity 

When the initial state is known, we can make use of 
this information to improve the distillation by selecting 
at each step the most convenient permutation. Then the 
question is wether the protocols we are managing are able 
to distill any distillable state. As we lack a working algo- 
rithm to decide wether a given state is distillable, we will 
compare the normalized volume of distilled states to that 



> 0.5 - 




0.2 0.22 0.24 0.26 0.28 0.3 0.32 0.34 

F 

FIG. 7: Normalized volume V of distilled Bell diagonal states 
compared to that of NPPT states for D = 3. The mètric and 
the measuring algorithm are discussed in appendix|2]and uses 
Monte Cario. 

of NPPT states (states with a non positive partial trans- 
pose), since belonging to this set is a ncccssary condition 
for distillabüity 

We have chosen the following protocol with n = 2 and 
m = 1: At each step, one of the elements of Vs(D, 1) is 
applied to both pairs of qudits before the permutation 
pi?. The element is chosen so as to give the best fidelity 
after the (correct) measurement. 

Figure[7|shows the distillation capacities for D = 3. In 
general, for D prime the behavior is good since all states 
known to be distillable, i.e. those for which the fidelity is 
more than happen to be distillable with our protocol. 
More precisely, we have not found computationally any 
counterexample of this fact. Not all the NPPT states 
are distilled. This is perhaps another indication of the 
existence of non distillable NPPT states. In the case of 
composite numbers the algorithm performs much worse. 



VI. CONCLUSIONS AND PROSPECTS 

We have shown that the study of entanglement dis- 
tillation protocols based on the recursion method |5( is 
greatly benefited from the application of bàsic numbcr 
theory concepts when the set ZJ, associated to qudits of 
arbitrary dimensions D is a module, and not a vector 
space. In particular, we have found that a partition of 
ZJ) into divisor classes is very useful to characterize the 
invariant properties of mixed Bell diagonal states under 
unitary groups that implcment local permutations. This 
permutations, in turn, are used in very general distilla- 
tion protocols based on the recursion method. 

We have proposed and study a variety of distillation 
protocols that fall into two classes depending on whether 
we use twirling operations or not at intermediate steps 
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of the protocols. When the twirling operations are ab- 
sent, our distillation protocols amount to extensions of 
the quantum privacy amplification protocols Q vàlid for 
arbitrary qudit dimensions D. This is very interesting 
and relevant for quantum commmunications with arbi- 
trary large alphabets since they remain secure and oper- 
ative even in the presence of quantum noisy channels. 

These properties obtained from number theory are not 
only useful in the analytical understanding of the proto- 
cols, but also facilitate a lot the construction of numerical 
methods for their study using Monte Cario. In particu- 
lar, we have characterized how the distillation protocols 
based on the recursion method and local permutations 
are qualitatively and quantitatively optimal when the di- 
mension of the qudit states D is a prime number. We 
leave open the problem of how to construct better distil- 
lation protocols when D is not a prime number and in 
this regard, the use of the heterotropic states introduced 
here is a promising tool. 
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where A and B are invertible and D is a diagonal matrix. 

With this tool at hand, we are ready to start with our 
analysis. We adopt the usual definition of linear inde- 
pendence for a finite subset of ZJ,, but the following is 
more surprising: 

Definition A.l Consider any M £ M pxç (Z£>) and let 
S r be the set of all r x r minors of M , r £ R := 
{1, . . . , min(p, q)}. The rank of M is defined as 

rank(AÍ) := max {0} U { r £ R : gcd(SV) = 1 }■ (A3) 

The rank of a matrix does not vary when we apply the 
elementary operations discussed above (see (TlHl and take 
into account that d\x and d\y iff d\x and d\x + y). As ex- 
pected, a square matrix is invertible iff its rank is max- 
imal. The following statement clarifies this strange defi- 
nition: 

Proposition A.2 The rows of a matrix M £ 
Mp XI1 (Zfl) form a Li. set iff rank(M) = p. 



Proof. Recali decomposition (IA2() for M (we will use 
directly the notation there) and consider any v £ TP D : 



APPENDIX A: PROPERTIES OF THE MODULE 

Zn 
D 

In this appendix we show how many ideas from genuine 
vector spaces can be adapted to the module ZJ,. First 
of all, we say that an element of s £ Zijj is invertible 
if there exists s' £ such that ss' = 1. If x £ N is 
a representant of s, this is equivalent to gcd(x, D) = 1. 
When D is not prime, non invertible elements other than 
zero exist (they are múltiples of proper divisors of D) 
and we need to introduce a work around in the gaussian 
elimination method, as we shall explain now. 

Suppose we are given an element of Z|,, say (x,y), 
and we are asked to get x = using two elementary 
transformations: 

{x,y) (x,x + y), (x,y) -A (x + y,y), (Al) 

The algorithm turns out to be quite simple. Consider for 
a moment the arbitrary ordering in Zd < 1 < ■ • • < 
D — 1. At each step, if x < y use 0\ to get < y < x, 
proceed inversely on the contrary. Clearly, x — or y = 
is reached in a finite number of steps. If y — 0, just apply 
0\ once and Oi D — 1 times. 

We shall use gaussian elimination, with the aid of the 
above trick, to convert any matrix M of size p x q into 
a very simple one. Suppose p < q; the converse case is 
similar. Summing one row to another amounts to take 
the product (from the left) with a p x p invertible matrix. 
The same is true for columns (from the right, qxq). Using 
this elementary operations we can obtain: 



C = AMB, 



v*M 







v'A^CB- 1 







v C 



0, 



where v = A*v'. This shows that the rows of M form a 
Li. set iff the rows ofC do. On the other hand, rank(C) = 
rank(M), and for the matrix C the statement is trivial. 

□ 

Given a set S — {vi, . . . , vj,} C ZJ,, we will denote 
by L'mS the subset of ZJ, spanned by the elements of 
S, that is, the set of linear combinations of the vectors 
in S. Clearly, if S is Li. OLinS = D k , and so k < n. 
Not surprisingly, any Li. set which spans Z^ will be 
called a base of ZJ,. The usual definition of subspace 
does not work, however, and we introduce in its place 
the following: 

Definition A.3 A set V C ZJ, is said to be a subspace of 
ifV = {0} or if there exists a set S = {vi, . . . , Vfc} C 
T/f-) such that it is Li. and LinS 1 = V. Such a set is 
called a base of V , and its cardinality is the dimension of 
V (dimV). 

Dimension is well defined since jjy = D* s forbids the 
possibility of two bases of different cardinality. 

Proposition A.4 Given a set S = {vi, . . . , v^} C Z^, 

which is linearly independent, there exists a set S' = 
{vfc + i, . . . , v„} such that S U S' is a base of Ïd- 

Proof. Let M be a k x n matrix such that its rows are 
the elements of S. We recali (|A2|) but rewrite it in terms 
of n x n square matrices: 









D 




A 




M 


c = 


D 


(A2) 







1 








B 



(A4) 
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Now consider the following: 



Now proving part 1 of the lemma is easy. Start with 



M 




A- 1 




D 





M' 




1 







1 



B- 1 (A5) 



It is enough to construct S' with the rows of M'. □ 

Corolary A.5 Given a subspace V of dimension d and a 
set S = {vi, . . . , Vfe} C V which is linearly independent, 
there exists a set S' = {vfc+i, . . . , v^} such that S U S" is 
a base of V. 

Proof. Select any base of V and consider the components 
of vectors respect to that base as elements of Z^, . □ 
We adopt the usual definition and notations for the 
scalar product and orthogonality. 

Proposition A.6 The subset ofT/jj orthogonal to a sub- 
space V (that is, V^) is a subspace. Moreover, dimV + 
dim V = n. 

Proof. Let d — dim V and let M be a d x n matrix such 
that its rows form a base of V. We use decomposition 
Ï2l) (again). For any v £ ZJ> 



Mv = 



A~ l CB~ l v = 



C(v') = 0, (A6) 



with v = Bv' . The set of the v'-s verifying the equation 
is clearly a subspace of the expected dimension. □ 



APPENDIX B: CARDINALITY OF C d {D,n): 
GENERALIZED EULER'S TOTIENT FUNCTION 



This appendix is devoted to the proof of lemma III. 21 
We start with part 2, which can be rewritten as: 

jjCi (D, n) = §Cd(dD, n) VD>2,n>l,d>l (Bl) 

This is equivalent to the existence of a one to one map- 
ping from Ci(D,n) onto Cd(dD,n). Consider the map- 
ping: 



/i : Z" 
v 



Z" 
dv 



(B2) 
(B3) 



/i induces a mapping [i : Z^ — > Z^, which is well de- 
fined and one-to-one because x = y (mod D) dx = dy 
(mod dD). From IT1I we learn that VveZ" 

d\ gcd(/l(v)), 

where v is the result of mapping v in ZJ, . Since for any 
iéZ and d' £ div(f) we have d'\x <=> d'd\dx, it follows 
that 



dgcd(v) = gcd(/i(v)), 



(B4) 



which implics that C\{D,n) is mapped into Cd(dD,n). 
Since for any element of Cd{dD, n) there exists a suitable 
v, the mapping is onto. 



<p n (D)=D n - Y, W d (D,n) 
dediv(D)-{i} 

^ D ( B5 ) 

dediv(D)-{l} 

Changing the index, we get a beautiful recursive relation: 

Md)- (B6) 



l {D) = D n - E ' 

dedív(D)-{D} 



With some àlgebra on this expression it is possible to 
show that 4> n (D) is a multiplicative function: A func- 
tion / : N — > N is said to be multiplicative if f(nm) = 
f(n)f(m) V n,m £ N such that gcd(m, n) = 1. Thus, we 
only have to solve the recursion for D — p q , p prime, but 
this poses no difficulty: 



(B7) 



from which (|17|l follows. 

Part 3 of the lemma is nothing but the recursion rela- 
tion just constructed. 



APPENDIX C: GENERATORS OF T s 

In order to study Va it is preferable to consider its 
elements as permutations ovcr ZJ, x Z , and so we change 
the notation 



7r(x), 



x £ Z 



2 n 

D 



(Cl) 



for 



►(Mi,j) J i'(y))> UeZ£. (C2) 

where the correspondence is the same as in (|llll . 
Lemma Cl V s is generated by its following elements: 



7T 1 



'+ ) 



swap 3 



with /J,(í, j 



WÜh yLt(í, j 
with jLt(Í, j 
with 



k +h,32, ■ ■ -Jn); 

jl,Í2, ■ ■ ■ ,Ín), 

-Í1J2, ■ ■ -,jn); 

h + Í2,h, ■ ■ ■ ,in), 
3\,32 -jl, ■ ■ -,jn); 
■ , il-l,im, íl+1, ■ ■ ■ , 
Ím—1 ; H 1 ; ■ ■ ■ ) ; 

v(hí) = (■ ■ ■dl-l,3m,jl+l, 

jm-l,jl,jm+l>---)> l,m= l,...,n. 
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Proof. In order to proof this, first let us define 



xch 



li 1 1 i 

7T O 7T O 7T 

swap + swap ) 

7T U O 7T 1 u r ~ U 
swap xch 



ir u O TT 2j 
swap swap 



swap ) 
O 7r]^ O 



7T U 7T 2j , 
swap swap ' 



(C3) 
(C4) 
(C5) 



with i,j = 1, . . . ,n. Consider any p S P s ; our goal is 
to act from the left and from the right with these per- 
mutations till we get the identity, which is equivalent to 
the statement of the lemma. We shall use the matrix 
representation of the permutations, and the process is a 
suitable gaussian elimination similar to the one used in 
appendix [S] The difference is that now we cannot per- 
forin freely any sum of lines or columns, but only those 
which have associated a permutation in the above set. 

To work around this problem, in place of IjAlj) we con- 
sider 



(x,y) (x,x + y), 



{x,y) — > (ey,x) 



'xch 

„ to ©3(1), with care in the case of tt+ and 7Tg4 a p f° r 



±1 

Since O2 can be constructed suitably combining 0\ and 
03 (— 1), only the case e = 1 is really different, but adapt- 
ing the algorithm is straightforward. The point is that 
-k\ and 71+ can be attachcd to 0\, n^ ch to Oz(— 1) and 

swap 

their additional effects. 

To perform the elimination in an element of V s with 
associated matrix M, start working over the first column 
(permutations act thereby from the left). Using p\ and 
p l ex make zero the elements Aí n +i 1 to M2 n ,i, and then 
use p+ and pl l wap till just M\\ is nonzero in the first 
column. The process must be repeated for the first row 
(this time permutations act from the right). Now let 
us deal with the second column, first making zero the 
elements M n+2y 2 to M 2n ,2, afterwards the elements M 3 2 
to M n 2- Do the same for the second row. The process 
must be carried out for the first n rows and columns, till 
we get something of the form 



D Ti 
T 2 M 



(C7) 



with D diagonal, T\ lower triangular and T 2 upper tri- 
angular. But in fact applying the condition l|28|) forces 
7\ = T 2 = and M = D -1 . Now we note that 



(C8) 



Since the matrices in the right side are trivially con- 
structed with the given set of generators, this ends the 
proof. □ 



D 




1 




1 




1 1 


D- 1 




—D 1 




D-l 1 




1 







APPENDIX D: PROOF OF THEOREM IÏÏLÏ1 

(This proof uses the notation and results of appendix 



(1) Since V T is invariant in the product group trivially, 
we prové both sides of the inclusion, starting with V loc C 
V T k V s . 

Later we define local unitary operators implementing 
Vt (see (|D7|) '). and so we just bother about those U S 
W B i oc (-D,n) that leave |0 0) B (0 0| invariant. Moreover, as 
the global phase is unimportant, we select for the analysis 
those operators for which U\0 0) B = |0 0) B . But U is local, 
and then these constraints are equivalent toí7 = Ua®U^ 
(conjugation respect to the computational basis). We can 
thus write: 

U\ii)=SA^\kl), S^^k = S(i-j) (Dl) 

kl k 

with A a unitary matrix on a single party ( Alice or Bob) . 
Using ©, we get 

U\i j) B = £ *>(k • i - m • l)v4 lk A-„, k _j |m n) B . (D2) 

klmn 

On the other hand, the action of U involves a permuta- 
tion over Bell states: 

?7|ij) s =0(i,j)|M(iJ) v(i,j)) B . (D3) 
Identifying both expressions (Bell states are orthogonal) : 

<t>(i, j) S(m - j)) 5(n - = 

Sv(k i 1 m)AikAÍ k _j . (D4) 

kl 

Act on both sides of this equation with the Fourier oper- 
ator <S mn ip(r ■ m)y4 r _ n s _j to obtain: 



(D5) 



Choose any r, s such that A TS ^ 0, intèrpret this equation 
as a recurrence relation and consider the commutative 
diagram: 



A r 



A 



r— wfij),s— j 



.4 



r-7r(i' J'),s— J' 



A 



r-7r(ij)-7r(i',j'),s-j-j' 



Switching again to the Z^ 1 notation, the commutation 
condition is 



x'fix' = 7r(x) t í]7r(x') 



(D6) 



for any x,x' € Zg l . Thus, tt e T s . 

We now show that V T X V s C "P loc . Thanks to lemma 
IC.ll it is enough to construct a few permutations by 
means of unitary local operators. We start with transla- 
tions. Choosing 



I7 A |i>=v(i·a)|i) J U B \Ï) 
with a,be , the effect is 

/i(i,j) = i + a, u(i,j) 



(D7) 
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This is not the only subgroup easily generated, we have 
also that 

U A \ï) = \Si), U B \ï) = \Si), (D8) 
with S € Z^> x Z^> and invertible give 

[i(i,j) = (s t )-H, Kij) = Sj. 

Both of these results can be checked with a few manipu- 
lations in ijTÜ|l . Since n l ™ ap is physically trivial and n 1 " 1 is 
contained in the last construction, the only permutations 
we have not still covered are ni. and ír^ch' but as these in- 
volve only the first pair of qudits we can hx n = 1 in JD5|) 
and try the ansatz Aik = <p(ri(i,j)), with r)(i,j) G R/D. 
This results in: 

V(l-v(i>j)>k-j) = r)(l,k) + ki-lv(i,j)-$(i,j), (D9) 

where <p(4>(i,j)) := <f>(i,j). Solutions to this equation 
requirc rj to be a second order polynomial, limiting the 
permutation to: 

Khí) = a 3+ bv (hj), v{h.Í) = -a~ 1 ( , i + cj), (D10) 

where a, 6, c S Z^, a invertible. A compatible choice for 
i] is 

»7(*,j) =aÚ' + ^ 2 + ^' 2 - (Dll) 

The permutations we were searching for belong to the set 
of ífTTml . 

(2) In order to proof the second part of the theorem it 
is enough to analyze which are the realizations of the 
identity permutation. Going back to l|D5(l and fixing 
= i and = j we find the equation 

^r-j,s-j = <ys(s • i - r • i) 0(i, j)*A r , s . (D12) 

Modulo a global phase H3U|) . the solutions are exactly of 
the form: 

0(ij) = p(a-i + b-j) (D13) 
A rs = <^(b • s)ó(s - r - a) (D14) 

where a, b <E Z^>. But this is Í7 X in (|3Ü|> with 

x= (6i,...,6 n ,-ai,...,-a„). (D15) 

APPENDIX E: ORDER OF Vs 

In this appendix we offer a proof of theorem IIII.2I 
We first note that, except for a sign, U; and Vj play in- 
terchangeable roles. Thus it is enough to consider a case 
with t — (if t > 1, suitable exchanges between u-s and 
v-s and sign adjustments will be enough). We shall con- 
sider two cases separately, depending on wether r < n. 
In both cases the target is to find out in how many ways 



a new vector can be included in the set. Such a vector 
must fulfill 131fl and be linearly independent respect to 
the initial set. 

Suppose r < n. We would like to know how 
many vectors can take the role of u r+ i. Let S — 
{ui, . . . , u r , Vi, . . . , v s } and V = Lin{ íl v : v G S }. 
From l|31|l we have u r+ i G V (and no further condi- 
tions) , so let S' = {u s+ i , . . . , u r , wi , . . . , w 2 („_ r ) } be a 
base of V . We claim that S U S' is Li., that is, the 
equation 

1 — s 2(n—r) s 

Í—1 2—1 Í—1 

holds only if all the scalars are zero. This is so be- 
cause taking the scalar product with Q ut (k < s) we 
get dk = 0; using flvk, Ck = 0. The rest of the 
scalars must be zero because S' is Li. Therefore there 
are D r ~ s (f>2{ n -r) (D) suitable vectors, since we can choose 
any combination of the form 

i — s 2(n— r) 

u r+l = ^2 aiUs +3 + X! ÒiWi 
i=l i=l 

for which gcd({6i, . . . , b 2 ( n - r )}) = 1 (this is why the fac- 
tor 4>2(n~r){D) appears, see l|16|lL 

Now suppose r = n, s < n. We pursue v s+ i. 
Let S = {ui, . . . ,u s ,u s+2 , . . . ,u„,vi, . ,.,v,} and V = 
Lin{ Í7v : v G S}. From (|31|l we have v s+ i G V and 
u* + i íív s +i = 1. Let S' = {u s +i, . . . ,u„,w} be a base 
of V 1 - and let s := u' +1 ílw. We first show that s is in- 
vertible. Let V = Lin { O uj., . . . , !íu„, íí vi, . . . , fi v s }. 
If s is non invertible, choose any k ^ such that 
fes = 0. Thcn feu* +1 ílw = implies few G V lX - = 
Lin{u s+ i, . . . , u n }, but this is not possible because S' is 
linearly independent. We now show that S U {u s _|_i,w} 
is Li. If it is not, then w G Lin (5 U {u s+ i}), but this in 
turn implies u^ +1 Q w = 0, which again is false. There- 
fore, there are D n ~ s suitable vectors, since we can choose 
any of the following combinations: 

n — s 

v s+ i = s _1 w + ^ CiU s+i . 

i=i 

With this, part 1 of the theorem is proved. For part 
2, it only remains to count. There are <t>2n{D) possible 
vàlues for m. If Ui is fixed, there are D(j)2 n {D) possible 
elections for u 2 . Continuing this way, one gets the desired 
result. 



APPENDIX F: RECURSION RELATIONS FOR 
DISTILLATION PROTOCOLS 

In this appendix we derive an expression for the final 
state of the remaining pairs of qudits when the procedure 
of sectionlVlhas been successfully performed. We will use 
the same notation found there. 
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2n 



So let us define for x, y £ Zj^ 



^:= B (x|p ( "»|y) 



(FI) 



from which p x = . Aftcr the permutation with asso- 
ciated matrix M and phase function (fi the state is 



E • 



(x)0*(y)p^|Mx) B (My|. (F2) 



The measurement is performed in the computational ba- 
sis (for the last n — ni pairs), and the rest of pairs are 
kept only if this measurement coincides for each of the 
measured pairs (if Alice measures |3), so does Bob for the 
corresponding qudit). Going back to JSJl, this means that 
j is zero for each of the pairs. Therefore after the mea- 
surement and taking the partial trace over the measured 
pairs the state of the first m pairs is: 



1 



=- »<k0| /><»>' |kO> B1 (F3) 

kez"- m 



where the Bell states must be understood to belong to the 
space of the last n — m pairs and P is the probability of 
having obtained the suitable measurement. Calculating 
it amounts to take the total trace: 



P 



E 



£ U*|® B <kO|)pí»>' (|x) B ®|kO) B ) 



Inserting definition l|F2|l. we get JEJ. 

The state of the system before the measurement can 
also be expressed 

p<">'= ]T ^(M- 1 x)^(M- 1 y )^ ) - lx , M - ly |x) B (y|. 

x,yeZ 2 D " 



Inserting this expression in (|F3I 



E 

kez^- 



r(M-\í + y))p^ +5t)M - HÍ+9) (F4) 



where x, y £ Z|5 n , x and y are defined as in (|45|l and: 
k := ( 0, ■ ■■ ,0 , fei, . . .,fe n - m , 0, ■■ 

m n 

With the definition for V M given in section^ we have 
B (x|^'|y) e = l ]T ^z + M" 1 *) 



(14411 follows setting x = y. 
APPENDIX G: MONTE CARLO MEASURING 

We introduce a suitable mètric in the space of Bell di- 
agonal states in order to perform several measures. For 
simplicity, we have chosen the mètric induced by mapping 
physical states into Euclidean space taking the eigenval- 
ues as coordinates. 

We have chosen a Monte Cario approach to perform 
the measurements. This approach consists in randomly 
generating points of the space according to the measure 
on that space, and counting how many of them arc inside 
the measured set. 

In our case, numerically implementing such a measure 
is not difhcult if fidelity is not low. Consider a Bell diag- 
onal state of fidelity F. There are D 2 — 1 free coordinates 
(eigenvalues) A.; subject to the constraints 



< A,; < F, 



5> = 1-F. 



(Gl) 



The random generation is achieved as follows. We take 
for each point D 2 — 2 real random variables Xi uniformly 
distributed in [0, 1] (i = 1, . . . , D 2 - 2). Defining x := 
and xjj2_i := 1, we set A; = (1 — F)(xí+i — xi). If A^ > F 
for any i, we simply discard the point. Else, it bclongs 
to the space of interest. Then it is checked wether it 
belongs to the measured set, by running the appropiate 
algorithm. For example, if we are checking distillability 
through a given protocol, this is the moment were the 
protocol is numerically simulated till the point converges. 
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